diff --git a/internal/cmd/web.go b/internal/cmd/web.go
index 09c173f40c..6a64f26ba2 100644
--- a/internal/cmd/web.go
+++ b/internal/cmd/web.go
@@ -314,6 +314,7 @@ func runWeb(c *cli.Context) error {
 				}
 				defer fr.Close()
 
+				c.Header().Set("Content-Security-Policy", "default-src 'none'; style-src 'unsafe-inline'; sandbox")
 				c.Header().Set("Cache-Control", "public,max-age=86400")
 				c.Header().Set("Content-Disposition", fmt.Sprintf(`inline; filename="%s"`, attach.Name))